===================================================================
--- pngread.c
+++ pngread.c
-@@ -292,6 +292,11 @@
+@@ -300,6 +300,11 @@
#ifdef PNG_READ_zTXt_SUPPORTED
PNG_zTXt;
#endif
png_uint_32 length = png_read_chunk_header(png_ptr);
PNG_CONST png_bytep chunk_name = png_ptr->chunk_name;
-@@ -335,6 +340,9 @@
+@@ -343,6 +348,9 @@
!(png_ptr->mode & PNG_HAVE_PLTE))
png_error(png_ptr, "Missing PLTE before IDAT");
png_ptr->idat_size = length;
png_ptr->mode |= PNG_HAVE_IDAT;
break;
-@@ -407,12 +415,95 @@
+@@ -415,12 +423,95 @@
else if (!png_memcmp(chunk_name, png_iTXt, 4))
png_handle_iTXt(png_ptr, info_ptr, length);
#endif
/* Optional call to update the users info_ptr structure */
void PNGAPI
png_read_update_info(png_structp png_ptr, png_infop info_ptr)
-@@ -453,6 +544,10 @@
+@@ -461,6 +552,10 @@
png_read_row(png_structp png_ptr, png_bytep row, png_bytep dsp_row)
{
PNG_IDAT;
PNG_CONST int png_pass_dsp_mask[7] = {0xff, 0x0f, 0xff, 0x33, 0xff, 0x55,
0xff};
PNG_CONST int png_pass_mask[7] = {0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff};
-@@ -585,13 +680,39 @@
+@@ -596,13 +691,39 @@
{
if (!(png_ptr->zstream.avail_in))
{
}
png_ptr->zstream.avail_in = (uInt)png_ptr->zbuf_size;
png_ptr->zstream.next_in = png_ptr->zbuf;
-@@ -609,6 +730,9 @@
+@@ -620,6 +741,9 @@
png_benign_error(png_ptr, "Extra compressed data");
png_ptr->mode |= PNG_AFTER_IDAT;
png_ptr->flags |= PNG_FLAG_ZLIB_FINISHED;
break;
}
if (ret != Z_OK)
-@@ -864,6 +988,11 @@
+@@ -875,6 +999,11 @@
#ifdef PNG_READ_zTXt_SUPPORTED
PNG_zTXt;
#endif
png_uint_32 length = png_read_chunk_header(png_ptr);
PNG_CONST png_bytep chunk_name = png_ptr->chunk_name;
-@@ -963,6 +1092,14 @@
+@@ -974,6 +1103,14 @@
else if (!png_memcmp(chunk_name, png_iTXt, 4))
png_handle_iTXt(png_ptr, info_ptr, length);
#endif
===================================================================
--- png.h
+++ png.h
-@@ -861,6 +861,19 @@
+@@ -888,6 +888,19 @@
png_fixed_point int_y_blue PNG_DEPSTRUCT;
#endif
} png_info;
typedef png_info FAR * png_infop;
-@@ -958,6 +971,10 @@
+@@ -985,6 +998,10 @@
#define PNG_INFO_sPLT 0x2000 /* ESR, 1.0.6 */
#define PNG_INFO_sCAL 0x4000 /* ESR, 1.0.6 */
#define PNG_INFO_IDAT 0x8000L /* ESR, 1.0.6 */
/* This is used for the transformation routines, as some of them
* change these values for the row. It also should enable using
-@@ -998,6 +1015,10 @@
+@@ -1026,6 +1043,10 @@
typedef void (PNGAPI *png_progressive_end_ptr) PNGARG((png_structp, png_infop));
typedef void (PNGAPI *png_progressive_row_ptr) PNGARG((png_structp, png_bytep,
png_uint_32, int));
#endif
#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) || \
-@@ -1320,6 +1341,39 @@
+@@ -1445,6 +1466,39 @@
png_uint_32 user_chunk_cache_max PNG_DEPSTRUCT;
#endif
/* New member added in libpng-1.0.25 and 1.2.17 */
#ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
/* Storage for unknown chunk that the library doesn't recognize. */
-@@ -1648,6 +1702,18 @@
+@@ -1773,6 +1827,18 @@
extern PNG_EXPORT(void,png_write_image) PNGARG((png_structp png_ptr,
png_bytepp image));
/* Write the end of the PNG file. */
extern PNG_EXPORT(void,png_write_end) PNGARG((png_structp png_ptr,
png_infop info_ptr));
-@@ -1891,6 +1957,11 @@
+@@ -2017,6 +2083,11 @@
png_voidp progressive_ptr,
png_progressive_info_ptr info_fn, png_progressive_row_ptr row_fn,
png_progressive_end_ptr end_fn));
/* Returns the user pointer associated with the push read functions */
extern PNG_EXPORT(png_voidp,png_get_progressive_ptr)
-@@ -2317,6 +2388,59 @@
+@@ -2443,6 +2514,53 @@
#endif
#endif /* PNG_sCAL_SUPPORTED || PNG_WRITE_sCAL_SUPPORTED */
+ png_uint_32 height, png_uint_32 x_offset, png_uint_32 y_offset,
+ png_uint_16 delay_num, png_uint_16 delay_den, png_byte dispose_op,
+ png_byte blend_op));
-+extern PNG_EXPORT(void,png_ensure_fcTL_is_valid)
-+ PNGARG((png_structp png_ptr,
-+ png_uint_32 width, png_uint_32 height,
-+ png_uint_32 x_offset, png_uint_32 y_offset,
-+ png_uint_16 delay_num, png_uint_16 delay_den,
-+ png_byte dispose_op, png_byte blend_op));
+extern PNG_EXPORT(png_uint_32,png_get_next_frame_width)
+ PNGARG((png_structp png_ptr, png_infop info_ptr));
+extern PNG_EXPORT(png_uint_32,png_get_next_frame_height)
/* These are the functions that do the transformations */
#ifdef PNG_READ_FILLER_SUPPORTED
PNG_EXTERN void png_do_read_filler PNGARG((png_row_infop row_info,
-@@ -735,6 +769,18 @@
+@@ -736,6 +770,25 @@
png_uint_32 length));
#endif
+PNG_EXTERN void png_ensure_sequence_number PNGARG((png_structp png_ptr,
+ png_uint_32 length));
+#endif
++#ifdef PNG_APNG_SUPPORTED
++PNG_EXTERN void png_ensure_fcTL_is_valid PNGARG((png_structp png_ptr,
++ png_uint_32 width, png_uint_32 height,
++ png_uint_32 x_offset, png_uint_32 y_offset,
++ png_uint_16 delay_num, png_uint_16 delay_den,
++ png_byte dispose_op, png_byte blend_op));
++#endif
+
PNG_EXTERN void png_handle_unknown PNGARG((png_structp png_ptr,
png_infop info_ptr, png_uint_32 length));
===================================================================
--- pngwrite.c
+++ pngwrite.c
-@@ -56,6 +56,10 @@
+@@ -57,6 +57,10 @@
/* The rest of these check to see if the valid field has the appropriate
* flag set, and if it does, writes the chunk.
*/
#ifdef PNG_WRITE_gAMA_SUPPORTED
if (info_ptr->valid & PNG_INFO_gAMA)
{
-@@ -318,6 +322,10 @@
+@@ -319,6 +323,10 @@
return;
if (!(png_ptr->mode & PNG_HAVE_IDAT))
png_error(png_ptr, "No IDATs written into file");
/* See if user wants us to write information chunks */
if (info_ptr != NULL)
-@@ -1451,4 +1459,39 @@
+@@ -1454,4 +1462,39 @@
params = params;
}
#endif
===================================================================
--- pngconf.h
+++ pngconf.h
-@@ -845,6 +845,10 @@
+@@ -869,6 +869,10 @@
# define PNG_READ_tRNS_SUPPORTED
# define PNG_tRNS_SUPPORTED
#endif
#ifndef PNG_NO_READ_zTXt
# define PNG_READ_zTXt_SUPPORTED
# define PNG_zTXt_SUPPORTED
-@@ -1002,6 +1006,14 @@
+@@ -1028,6 +1032,14 @@
# define PNG_TEXT_SUPPORTED
# endif
#endif
png_ptr->idat_size = png_ptr->push_length;
png_ptr->mode |= PNG_HAVE_IDAT;
png_ptr->process_mode = PNG_READ_IDAT_MODE;
-@@ -555,6 +660,38 @@
+@@ -557,6 +662,38 @@
}
#endif
else
{
if (png_ptr->push_length + 4 > png_ptr->buffer_size)
-@@ -729,11 +866,15 @@
+@@ -736,11 +873,15 @@
png_push_read_IDAT(png_structp png_ptr)
{
PNG_IDAT;
{
png_push_save_buffer(png_ptr);
return;
-@@ -745,15 +886,62 @@
+@@ -752,15 +893,62 @@
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
}
if (png_ptr->idat_size && png_ptr->save_buffer_size)
{
-@@ -1710,6 +1898,17 @@
+@@ -1716,6 +1904,17 @@
png_set_read_fn(png_ptr, progressive_ptr, png_push_fill_buffer);
}
===================================================================
--- pngrutil.c
+++ pngrutil.c
-@@ -423,6 +423,11 @@
+@@ -434,6 +434,11 @@
filter_type = buf[11];
interlace_type = buf[12];
/* Set internal variables */
png_ptr->width = width;
png_ptr->height = height;
-@@ -2294,6 +2299,168 @@
+@@ -2318,6 +2323,168 @@
}
#endif
+
+ png_debug(1, "in png_handle_fcTL");
+
++ png_ensure_sequence_number(png_ptr, length);
++
+ if (!(png_ptr->mode & PNG_HAVE_IHDR))
+ {
+ png_error(png_ptr, "Missing IHDR before fcTL");
+ * but correct. PNG_HAVE_IDAT is unset before the frame head is read
+ * i can't think of a better message */
+ png_warning(png_ptr, "Invalid fcTL after IDAT skipped");
-+ png_crc_finish(png_ptr, length);
++ png_crc_finish(png_ptr, length-4);
+ return;
+ }
+ else if (png_ptr->mode & PNG_HAVE_fcTL)
+ {
+ png_warning(png_ptr, "Duplicate fcTL within one frame skipped");
-+ png_crc_finish(png_ptr, length);
++ png_crc_finish(png_ptr, length-4);
+ return;
+ }
+ else if (length != 26)
+ {
+ png_warning(png_ptr, "fcTL with invalid length skipped");
-+ png_crc_finish(png_ptr, length);
++ png_crc_finish(png_ptr, length-4);
+ return;
+ }
+
-+ png_ensure_sequence_number(png_ptr, length);
-+
+ png_crc_read(png_ptr, data, 22);
+ png_crc_finish(png_ptr, 0);
+
/* This function is called when we haven't found a handler for a
chunk. If there isn't a problem with the chunk itself (ie bad
chunk name, CRC, or a critical chunk), the chunk is silently ignored
-@@ -3333,4 +3500,82 @@
+@@ -3353,4 +3520,73 @@
png_ptr->flags |= PNG_FLAG_ROW_INIT;
}
+
+ /* offset to next interlace block in the y direction */
+ const int FARDATA png_pass_yinc[] = {8, 8, 8, 4, 4, 2, 2};
-+ png_uint_32 row_bytes;
+
+ if (png_ptr->interlaced)
+ {
+ png_pass_inc[png_ptr->pass] - 1 -
+ png_pass_start[png_ptr->pass]) /
+ png_pass_inc[png_ptr->pass];
-+
-+ row_bytes = PNG_ROWBYTES(png_ptr->pixel_depth,png_ptr->iwidth) + 1;
-+
-+ png_ptr->irowbytes = (png_size_t)row_bytes;
-+ if((png_uint_32)png_ptr->irowbytes != row_bytes)
-+ png_error(png_ptr, "png_progressive_read_reset(): Rowbytes "
-+ "overflow");
+ }
+ else
+ {
+ png_ptr->num_rows = png_ptr->height;
+ png_ptr->iwidth = png_ptr->width;
-+ png_ptr->irowbytes = png_ptr->rowbytes + 1;
+ }
-+
+ png_ptr->flags &= ~PNG_FLAG_ZLIB_FINISHED;
+ if (inflateReset(&(png_ptr->zstream)) != Z_OK)
+ png_error(png_ptr, "inflateReset failed");
+ png_ptr->zstream.avail_in = 0;
+ png_ptr->zstream.next_in = 0;
+ png_ptr->zstream.next_out = png_ptr->row_buf;
-+ png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
++ png_ptr->zstream.avail_out = (uInt)PNG_ROWBYTES(png_ptr->pixel_depth,
++ png_ptr->iwidth) + 1;
+}
+#endif /* PNG_READ_APNG_SUPPORTED */
#endif /* PNG_READ_SUPPORTED */
===================================================================
--- pngwutil.c
+++ pngwutil.c
-@@ -538,6 +538,11 @@
+@@ -539,6 +539,11 @@
/* Write the chunk */
png_write_chunk(png_ptr, (png_bytep)png_IHDR, buf, (png_size_t)13);
/* Initialize zlib with PNG info */
png_ptr->zstream.zalloc = png_zalloc;
png_ptr->zstream.zfree = png_zfree;
-@@ -658,6 +663,9 @@
+@@ -661,6 +666,9 @@
png_write_IDAT(png_structp png_ptr, png_bytep data, png_size_t length)
{
PNG_IDAT;
png_debug(1, "in png_write_IDAT");
-@@ -702,7 +710,28 @@
+@@ -705,7 +713,28 @@
"Invalid zlib compression method or flags in IDAT");
}
png_ptr->mode |= PNG_HAVE_IDAT;
}
-@@ -1709,6 +1738,66 @@
+@@ -1712,6 +1741,66 @@
}
#endif
/* Initializes the row writing capability of libpng */
void /* PRIVATE */
png_write_start_row(png_structp png_ptr)
-@@ -2110,8 +2199,8 @@
+@@ -2113,8 +2202,8 @@
#ifndef PNG_WRITE_WEIGHTED_FILTER_SUPPORTED
if (png_ptr->row_number == 0 && filter_to_do == PNG_ALL_FILTERS)
{
}
#endif
-@@ -2780,4 +2869,39 @@
+@@ -2783,4 +2872,39 @@
}
#endif
}
===================================================================
--- pngrtran.c
+++ pngrtran.c
-@@ -1320,7 +1320,7 @@
+@@ -1325,7 +1325,7 @@
* pixels. This check added to libpng-1.2.19
*/
#if (PNG_WARN_UNINITIALIZED_ROW==1)